mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
usbnet: Fix memory leak in usbnet_disconnect()
[ Upstream commita432061562
] Currently usbnet_disconnect() unanchors and frees all deferred URBs using usb_scuttle_anchored_urbs(), which does not free urb->context, causing a memory leak as reported by syzbot. Use a usb_get_from_anchor() while loop instead, similar to what we did in commit19cfe912c3
("Bluetooth: btusb: Fix memory leak in play_deferred"). Also free urb->sg. Reported-and-tested-by: syzbot+dcd3e13cf4472f2e0ba1@syzkaller.appspotmail.com Fixes:69ee472f27
("usbnet & cdc-ether: Autosuspend for online devices") Fixes:638c5115a7
("USBNET: support DMA SG") Signed-off-by: Peilin Ye <peilin.ye@bytedance.com> Link: https://lore.kernel.org/r/20220923042551.2745-1-yepeilin.cs@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
c7a356e64e
commit
55ed972650
1 changed files with 6 additions and 1 deletions
|
@ -1598,6 +1598,7 @@ void usbnet_disconnect (struct usb_interface *intf)
|
|||
struct usbnet *dev;
|
||||
struct usb_device *xdev;
|
||||
struct net_device *net;
|
||||
struct urb *urb;
|
||||
|
||||
dev = usb_get_intfdata(intf);
|
||||
usb_set_intfdata(intf, NULL);
|
||||
|
@ -1614,7 +1615,11 @@ void usbnet_disconnect (struct usb_interface *intf)
|
|||
net = dev->net;
|
||||
unregister_netdev (net);
|
||||
|
||||
usb_scuttle_anchored_urbs(&dev->deferred);
|
||||
while ((urb = usb_get_from_anchor(&dev->deferred))) {
|
||||
dev_kfree_skb(urb->context);
|
||||
kfree(urb->sg);
|
||||
usb_free_urb(urb);
|
||||
}
|
||||
|
||||
if (dev->driver_info->unbind)
|
||||
dev->driver_info->unbind (dev, intf);
|
||||
|
|
Loading…
Reference in a new issue